Can anyone explain to me how Steven Kirsch's method actually works, technically?--or know of any other explanatory links?

Would be unendingly grateful!


http://thehermesproject.blogspot.com/2007/12/99-effective-anti-spam-solutions.html

Monday, 3 December 2007
99% effective anti spam solutions?
The New York Times is profiling a very interesting approach to the problem of spam - profiling the recipient rather than the sender, and the creator is claiming a 99% success rate for his technology. And he even backs that up with a money back guarantee.

Serial Silicon Valley entrepreneur Steven Kirsch has invested USD$5m in his Abaca e-mail protection gateway solution, and is causing waves amongst the anti-spam industry.

Kirsch, who is suffering from a rare form of blood cancer (another problem he is intending to solve), said:


"We were sitting around thinking of ways to obfuscate the description about how our system worked so the spammers would be misdirected.

So I came up with receiver reputation as something that might sound plausible. Then as I thought about it more and more, the more sense it made to me."
Kirsch claims that his solution will only get more effective as more users come online using it.

Might make them ripe for a takeoiver, giving him the time to solve that cancer problem.

'Kirsch, who is suffering from a rare form of blood cancer (another problem he is intending to solve),'

great sentence. Julian Simon would be porud!

dont know who his anti-spam-system works though

I could not, tell from that article and one other, anything about his technology. I'm more of a power user than a true computer geek, but the 2 phrases he uttered about the technology itself was too vague for me to even get an idea how his spam filter works. That might be his goal, though - trade secrets and what not.

Quote:

We were sitting around thinking of ways to obfuscate the description about how our system worked so the spammers would be misdirected.

If he is trying to use obfuscation and misdirection to protect his methods (which won't work in the long run - someone will reverse engineer it), he won't want to announce them in an interview or article.

I haven't heard of such method, and, more: I would doubt it's efficient. What you're looking at spam arena is an AI vs human brain. And it's a losing fight too. I've been working as e-mail administrator for many years, spam was never getting even close to defeated.

Currently the e-mail is routed using SMTP protocol, in which anybody can email anybody. Emails are relayed using same protocol, which means that it's not even possible to be certain of origin of the email. But this is not even the root of the problem. I think people just don't care. It's the same situation as with government. As long as they are only mildly irritated with spam, nobody will do anything about it.

Contrary to the common beleif, it's possible to eliminate pretty much 100% spam right now, today. One of technologies which can ensure that is a VERY old one, it's called S/MIME, also known as "digital signature". Pretty much every email client supports that. All you need to do is obtain digital certificate for email signing and start using it. Encourage others to do same thing, then start rejecting all unsigned emails. Set an auto-response "this email address only receives signed messages". Easy as that. We have yet to see a spammer who will bother obtaining a certificate, and if he does, he's trackable.

But noone cares...

I know what digital signatures are, but I didn't realize they could be used to prevent spam (as long as all my friends emailed me only using digitally signed emails). It's similar to white-lists. White-lists are lists of email addresses that you pre-approve to accept email from. This requires a special email client or a service (like SpamArrest.com), because whitelists are not built into the SMTP standard. When someone sends an email, the special email program or service receives it (not you) and forwards it to you only if the sender is on your list. If they are not on your list, their email is put on hold while the sender is automatically sent an email with instructions to add themselves to your list (if you allow that). This way, only humans can send spam, which greatly reduces the total amount of spam.

But all of this likely has nothing to do with Kirsch's method.

I have no idea if this is where he is coming from, but here's my crack at it.

As an avid email user, I get a ton of email every day. I could classify the email I get in to 3 categories...

1. Emails from friends, colleagues, and acquaintances. The content of these emails don't really matter, and vary wildly, yet I will open every one of them, usually immediately upon receipt.

2. Emails from memberships, forums, stores, feeds, etc. to which I belong, and have either voluntarily or involuntarily signed up for some sort of email notification. Depending on my mood, the sender, and expected content of the email, I might or might not open it, and even if I do, it may not be soon after I receive it.

3. Spam. Never open it...delete it as soon as I spot it.

Using information such as frequency of opening and how long it takes me to open emails with certain subject matters or senders, a filter could build a profile based on my email preferences. It could then use this profile to automatically segregate my mail to different folders. Combining that profile with other common Spam identification algorithms (key words, know senders, etc.), I think it would make for a fairly effective Spam filter.

I think most people don't actively participate (or don't participate better) in anti-spam measures because they don't care too much and because it's not easy enough. Digital signatures currently require the use to know what they're doing, both in setting one up and in receiving digitally signed emails. It's not tough, but most people who use emails are not computer geeks, or even power users. Whitelists are also not easy; you have to subscribe to a service (costs $), in which case the technical work is done for you but you still must enter the emails you want to whitelist, you must maintain your list as you add new friends, etc.

It may be similar to many people's view about government: many people know or don't care that government is evil and makes things worse, but they're comfortable enough in their lives so they don't want to do anything about it - too much effort.

FYI: I have email habits very similar to wilheldp's.

Zebra,

Are you aware of ITConversations.com ? They are a group of people recording and podcasting conferences and interviews and such stuff on the tech industry and some of the podcasts are by brilliant minds on the cutting edge of this and that. You might want to check them out. I get an RSS feed that lets me know what cool stuff I might wanna check out.

- NonE (being sorta on and sorta off topic, as usual...)